@dexto/tools-builtins 1.16.5 → 1.17.0

package/dist/implementations/http-request-tool.cjs

@@ -23,6 +23,8 @@ __export(http_request_tool_exports, {
 });
 module.exports = __toCommonJS(http_request_tool_exports);
 var import_zod = require("zod");
+var import_core = require("@dexto/core");
+var import_llm = require("@dexto/core/llm");
 var import_errors = require("@dexto/core/errors");
 var import_tools = require("@dexto/core/tools");
 var import_node_dns = require("node:dns");
@@ -54,56 +56,13 @@ const BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set(["localhost"]);
 const MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
 const MAX_REDIRECTS = 20;
 const SAFE_DISPATCHER = createSafeDispatcher();
-function isPrivateIpv4(ip) {
-  const parts = ip.split(".").map((part) => Number(part));
-  if (parts.length !== 4 || parts.some((part) => Number.isNaN(part))) {
-    return false;
-  }
-  const a = parts[0];
-  const b = parts[1];
-  const c = parts[2];
-  const d = parts[3];
-  if (a === void 0 || b === void 0 || c === void 0 || d === void 0) {
-    return false;
-  }
-  if (a === 0) return true;
-  if (a === 10) return true;
-  if (a === 127) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true;
-  if (a === 192 && b === 0 && c === 0) return true;
-  if (a === 192 && b === 0 && c === 2) return true;
-  if (a === 198 && b === 51 && c === 100) return true;
-  if (a === 203 && b === 0 && c === 113) return true;
-  if (a === 198 && (b === 18 || b === 19)) return true;
-  if (a >= 224 && a <= 239) return true;
-  if (a >= 240) return true;
-  return false;
-}
-function isPrivateIpv6(ip) {
-  const normalized = new URL(`http://[${ip.split("%")[0]}]/`).hostname.slice(1, -1);
-  if (normalized === "::" || normalized === "::1") return true;
-  if (normalized.startsWith("64:ff9b:1:")) return true;
-  if (/^fe[89ab][0-9a-f]:/.test(normalized)) return true;
-  if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true;
-  if (normalized.startsWith("::ffff:")) {
-    const parts = normalized.slice("::ffff:".length).split(":");
-    if (parts.length === 2) {
-      const high = Number.parseInt(parts[0] ?? "", 16);
-      const low = Number.parseInt(parts[1] ?? "", 16);
-      return isPrivateIpv4(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
-    }
-  }
-  return false;
-}
-function isPrivateAddress(ip) {
-  const address = ip.startsWith("[") && ip.endsWith("]") ? ip.slice(1, -1) : ip;
-  const version = (0, import_node_net.isIP)(address);
-  if (version === 4) return isPrivateIpv4(address);
-  if (version === 6) return isPrivateIpv6(address);
-  return false;
+function blockedTargetError(hostname) {
+  return new import_errors.DextoRuntimeError(
+    "HTTP_REQUEST_UNSAFE_TARGET",
+    import_errors.ErrorScope.TOOLS,
+    import_errors.ErrorType.FORBIDDEN,
+    `Request to ${hostname} is blocked`
+  );
 }
 function createSafeLookup(config) {
   const dnsLookup = config?.dnsLookup ?? import_node_dns.promises.lookup;
@@ -122,16 +81,11 @@ function createSafeLookup(config) {
       };
       try {
         if (BLOCKED_HOSTNAMES.has(hostname) || hostname.endsWith(".localhost")) {
-          emitError(
-            toErrnoException(
-              new import_errors.DextoRuntimeError(
-                "HTTP_REQUEST_UNSAFE_TARGET",
-                import_errors.ErrorScope.TOOLS,
-                import_errors.ErrorType.FORBIDDEN,
-                `Blocked request to local hostname: ${hostname}`
-              )
-            )
-          );
+          emitError(toErrnoException(blockedTargetError(hostname)));
+          return;
+        }
+        if ((0, import_core.isMetadataHost)(hostname)) {
+          emitError(toErrnoException(blockedTargetError(hostname)));
           return;
         }
         const records = await dnsLookup(hostname, {
@@ -154,17 +108,8 @@ function createSafeLookup(config) {
           return;
         }
         for (const record of records) {
-          if (isPrivateAddress(record.address)) {
-            emitError(
-              toErrnoException(
-                new import_errors.DextoRuntimeError(
-                  "HTTP_REQUEST_UNSAFE_TARGET",
-                  import_errors.ErrorScope.TOOLS,
-                  import_errors.ErrorType.FORBIDDEN,
-                  `Blocked request to private address: ${record.address}`
-                )
-              )
-            );
+          if ((0, import_core.isMetadataHost)(record.address) || (0, import_llm.isPrivateAddress)(record.address)) {
+            emitError(toErrnoException(blockedTargetError(hostname)));
             return;
           }
         }
@@ -235,20 +180,10 @@ async function assertSafeUrl(requestUrl) {
     );
   }
   if (BLOCKED_HOSTNAMES.has(hostname) || hostname.endsWith(".localhost")) {
-    throw new import_errors.DextoRuntimeError(
-      "HTTP_REQUEST_UNSAFE_TARGET",
-      import_errors.ErrorScope.TOOLS,
-      import_errors.ErrorType.FORBIDDEN,
-      `Blocked request to local hostname: ${hostname}`
-    );
+    throw blockedTargetError(hostname);
   }
-  if (isPrivateAddress(hostname)) {
-    throw new import_errors.DextoRuntimeError(
-      "HTTP_REQUEST_UNSAFE_TARGET",
-      import_errors.ErrorScope.TOOLS,
-      import_errors.ErrorType.FORBIDDEN,
-      `Blocked request to private address: ${hostname}`
-    );
+  if ((0, import_core.isMetadataHost)(hostname) || (0, import_llm.isPrivateAddress)(hostname)) {
+    throw blockedTargetError(hostname);
   }
 }
 async function readResponseTextWithLimit(response) {
@@ -356,11 +291,6 @@ function createHttpRequestTool() {
             );
           }
           const nextUrl = new URL(location, currentUrl);
-          if (nextUrl.origin !== currentUrl.origin) {
-            for (const key of Object.keys(requestHeaders)) {
-              delete requestHeaders[key];
-            }
-          }
           if (response.status === 303 || (response.status === 301 || response.status === 302) && requestInit.method === "POST") {
             requestInit.method = "GET";
             delete requestInit.body;
@@ -369,6 +299,19 @@ function createHttpRequestTool() {
                 delete requestHeaders[key];
             }
           }
+          if (nextUrl.origin !== currentUrl.origin) {
+            if (requestInit.body !== void 0) {
+              throw new import_errors.DextoRuntimeError(
+                "HTTP_REQUEST_REDIRECT_BLOCKED",
+                import_errors.ErrorScope.TOOLS,
+                import_errors.ErrorType.FORBIDDEN,
+                `Blocked a ${response.status} redirect to ${nextUrl.origin}: the request body is not sent to another origin`
+              );
+            }
+            for (const key of Object.keys(requestHeaders)) {
+              delete requestHeaders[key];
+            }
+          }
           currentUrl = nextUrl;
         }
         const responseText = await readResponseTextWithLimit(response);

package/dist/implementations/http-request-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-request-tool.d.ts","sourceRoot":"","sources":["../../src/implementations/http-request-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAwB,MAAM,mBAAmB,CAAC;AAQpE,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAKnF,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;kBA2Bf,CAAC;AA+Bd,KAAK,cAAc,GACb,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,GAC9E,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,IAAI,CAAC,CAAC;AA4DhF,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE;IACtC,SAAS,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC;CACjC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,CAyI/E;AA2FD;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAAC,OAAO,sBAAsB,CAAC,CA4I3E"}
+{"version":3,"file":"http-request-tool.d.ts","sourceRoot":"","sources":["../../src/implementations/http-request-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAwB,MAAM,mBAAmB,CAAC;AAUpE,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAKnF,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;kBA2Bf,CAAC;AA+Bd,KAAK,cAAc,GACb,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,GAC9E,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,IAAI,CAAC,CAAC;AAehF,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE;IACtC,SAAS,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC;CACjC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,CA4H/E;AAiFD;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAAC,OAAO,sBAAsB,CAAC,CAqJ3E"}

package/dist/implementations/http-request-tool.js

@@ -1,4 +1,6 @@
 import { z } from "zod";
+import { isMetadataHost } from "@dexto/core";
+import { isPrivateAddress } from "@dexto/core/llm";
 import { DextoRuntimeError, ErrorScope, ErrorType } from "@dexto/core/errors";
 import {
   TOOL_ACTIVITY,
@@ -35,56 +37,13 @@ const BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set(["localhost"]);
 const MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
 const MAX_REDIRECTS = 20;
 const SAFE_DISPATCHER = createSafeDispatcher();
-function isPrivateIpv4(ip) {
-  const parts = ip.split(".").map((part) => Number(part));
-  if (parts.length !== 4 || parts.some((part) => Number.isNaN(part))) {
-    return false;
-  }
-  const a = parts[0];
-  const b = parts[1];
-  const c = parts[2];
-  const d = parts[3];
-  if (a === void 0 || b === void 0 || c === void 0 || d === void 0) {
-    return false;
-  }
-  if (a === 0) return true;
-  if (a === 10) return true;
-  if (a === 127) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true;
-  if (a === 192 && b === 0 && c === 0) return true;
-  if (a === 192 && b === 0 && c === 2) return true;
-  if (a === 198 && b === 51 && c === 100) return true;
-  if (a === 203 && b === 0 && c === 113) return true;
-  if (a === 198 && (b === 18 || b === 19)) return true;
-  if (a >= 224 && a <= 239) return true;
-  if (a >= 240) return true;
-  return false;
-}
-function isPrivateIpv6(ip) {
-  const normalized = new URL(`http://[${ip.split("%")[0]}]/`).hostname.slice(1, -1);
-  if (normalized === "::" || normalized === "::1") return true;
-  if (normalized.startsWith("64:ff9b:1:")) return true;
-  if (/^fe[89ab][0-9a-f]:/.test(normalized)) return true;
-  if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true;
-  if (normalized.startsWith("::ffff:")) {
-    const parts = normalized.slice("::ffff:".length).split(":");
-    if (parts.length === 2) {
-      const high = Number.parseInt(parts[0] ?? "", 16);
-      const low = Number.parseInt(parts[1] ?? "", 16);
-      return isPrivateIpv4(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
-    }
-  }
-  return false;
-}
-function isPrivateAddress(ip) {
-  const address = ip.startsWith("[") && ip.endsWith("]") ? ip.slice(1, -1) : ip;
-  const version = isIP(address);
-  if (version === 4) return isPrivateIpv4(address);
-  if (version === 6) return isPrivateIpv6(address);
-  return false;
+function blockedTargetError(hostname) {
+  return new DextoRuntimeError(
+    "HTTP_REQUEST_UNSAFE_TARGET",
+    ErrorScope.TOOLS,
+    ErrorType.FORBIDDEN,
+    `Request to ${hostname} is blocked`
+  );
 }
 function createSafeLookup(config) {
   const dnsLookup = config?.dnsLookup ?? dns.lookup;
@@ -103,16 +62,11 @@ function createSafeLookup(config) {
       };
       try {
         if (BLOCKED_HOSTNAMES.has(hostname) || hostname.endsWith(".localhost")) {
-          emitError(
-            toErrnoException(
-              new DextoRuntimeError(
-                "HTTP_REQUEST_UNSAFE_TARGET",
-                ErrorScope.TOOLS,
-                ErrorType.FORBIDDEN,
-                `Blocked request to local hostname: ${hostname}`
-              )
-            )
-          );
+          emitError(toErrnoException(blockedTargetError(hostname)));
+          return;
+        }
+        if (isMetadataHost(hostname)) {
+          emitError(toErrnoException(blockedTargetError(hostname)));
           return;
         }
         const records = await dnsLookup(hostname, {
@@ -135,17 +89,8 @@ function createSafeLookup(config) {
           return;
         }
         for (const record of records) {
-          if (isPrivateAddress(record.address)) {
-            emitError(
-              toErrnoException(
-                new DextoRuntimeError(
-                  "HTTP_REQUEST_UNSAFE_TARGET",
-                  ErrorScope.TOOLS,
-                  ErrorType.FORBIDDEN,
-                  `Blocked request to private address: ${record.address}`
-                )
-              )
-            );
+          if (isMetadataHost(record.address) || isPrivateAddress(record.address)) {
+            emitError(toErrnoException(blockedTargetError(hostname)));
             return;
           }
         }
@@ -216,20 +161,10 @@ async function assertSafeUrl(requestUrl) {
     );
   }
   if (BLOCKED_HOSTNAMES.has(hostname) || hostname.endsWith(".localhost")) {
-    throw new DextoRuntimeError(
-      "HTTP_REQUEST_UNSAFE_TARGET",
-      ErrorScope.TOOLS,
-      ErrorType.FORBIDDEN,
-      `Blocked request to local hostname: ${hostname}`
-    );
+    throw blockedTargetError(hostname);
   }
-  if (isPrivateAddress(hostname)) {
-    throw new DextoRuntimeError(
-      "HTTP_REQUEST_UNSAFE_TARGET",
-      ErrorScope.TOOLS,
-      ErrorType.FORBIDDEN,
-      `Blocked request to private address: ${hostname}`
-    );
+  if (isMetadataHost(hostname) || isPrivateAddress(hostname)) {
+    throw blockedTargetError(hostname);
   }
 }
 async function readResponseTextWithLimit(response) {
@@ -337,11 +272,6 @@ function createHttpRequestTool() {
             );
           }
           const nextUrl = new URL(location, currentUrl);
-          if (nextUrl.origin !== currentUrl.origin) {
-            for (const key of Object.keys(requestHeaders)) {
-              delete requestHeaders[key];
-            }
-          }
           if (response.status === 303 || (response.status === 301 || response.status === 302) && requestInit.method === "POST") {
             requestInit.method = "GET";
             delete requestInit.body;
@@ -350,6 +280,19 @@ function createHttpRequestTool() {
                 delete requestHeaders[key];
             }
           }
+          if (nextUrl.origin !== currentUrl.origin) {
+            if (requestInit.body !== void 0) {
+              throw new DextoRuntimeError(
+                "HTTP_REQUEST_REDIRECT_BLOCKED",
+                ErrorScope.TOOLS,
+                ErrorType.FORBIDDEN,
+                `Blocked a ${response.status} redirect to ${nextUrl.origin}: the request body is not sent to another origin`
+              );
+            }
+            for (const key of Object.keys(requestHeaders)) {
+              delete requestHeaders[key];
+            }
+          }
           currentUrl = nextUrl;
         }
         const responseText = await readResponseTextWithLimit(response);

package/dist/implementations/http-request-tool.test.cjs

@@ -52,7 +52,12 @@ var import_http_request_tool = require("./http-request-tool.js");
     "[0:0:0:0:0:0:0:1]",
     "[::ffff:127.0.0.1]",
     "[::ffff:10.0.0.1]",
-    "[64:ff9b:1::a00:1]"
+    "[64:ff9b:1::a00:1]",
+    "[64:ff9b::7f00:1]",
+    "[fec0::1]",
+    "[feff::1]",
+    "[ff02::1]",
+    "[ff00::1]"
   ])("blocks private IPv6 literal %s before fetching", async (host) => {
     const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch");
     try {
@@ -67,6 +72,32 @@ var import_http_request_tool = require("./http-request-tool.js");
       fetchSpy.mockRestore();
     }
   });
+  (0, import_vitest.it)("refuses a name that answers a private address without echoing the answer", async () => {
+    const dnsLookup = import_vitest.vi.fn().mockResolvedValue([
+      { address: "93.184.216.34", family: 4 },
+      { address: "10.20.30.40", family: 4 }
+    ]);
+    const error = await new Promise((resolve) => {
+      (0, import_http_request_tool.createSafeLookup)({ dnsLookup })(
+        "files.example.com",
+        { all: true },
+        ((err) => resolve(err))
+      );
+    });
+    (0, import_vitest.expect)(error).toMatchObject({ code: "HTTP_REQUEST_UNSAFE_TARGET" });
+    (0, import_vitest.expect)(error?.message).toBe("Request to files.example.com is blocked");
+  });
+  import_vitest.it.each(["localhost", "10.0.0.1", "[::1]"])(
+    "refuses %s with a message that only names the host",
+    async (host) => {
+      await (0, import_vitest.expect)(
+        (0, import_http_request_tool.createHttpRequestTool)().execute(
+          { url: `http://${host}/`, method: "GET", timeoutMs: 1e3 },
+          {}
+        )
+      ).rejects.toMatchObject({ message: `Request to ${host} is blocked` });
+    }
+  );
   (0, import_vitest.it)("blocks a redirect to a private literal before the next request", async () => {
     const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch").mockResolvedValue(
       new Response(null, { status: 302, headers: { location: "http://[::1]/secret" } })
@@ -124,4 +155,220 @@ var import_http_request_tool = require("./http-request-tool.js");
       fetchSpy.mockRestore();
     }
   });
+  import_vitest.it.each([307, 308])(
+    "refuses a %i redirect that would send the body to another origin",
+    async (status) => {
+      const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch").mockResolvedValueOnce(
+        new Response(null, {
+          status,
+          headers: { location: "https://other.example/collect" }
+        })
+      ).mockResolvedValueOnce(new Response("ok"));
+      try {
+        await (0, import_vitest.expect)(
+          (0, import_http_request_tool.createHttpRequestTool)().execute(
+            {
+              url: "https://example.com/submit",
+              method: "POST",
+              body: { note: "private text" },
+              timeoutMs: 1e3
+            },
+            {}
+          )
+        ).rejects.toMatchObject({ code: "HTTP_REQUEST_REDIRECT_BLOCKED" });
+        (0, import_vitest.expect)(fetchSpy).toHaveBeenCalledTimes(1);
+      } finally {
+        fetchSpy.mockRestore();
+      }
+    }
+  );
+  import_vitest.it.each([
+    ["PUT", 301],
+    ["PATCH", 301],
+    ["PUT", 302],
+    ["DELETE", 302],
+    ["PATCH", 302]
+  ])(
+    "refuses a %s %i redirect that would send the body to another origin",
+    async (method, status) => {
+      const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch").mockResolvedValueOnce(
+        new Response(null, {
+          status,
+          headers: { location: "https://other.example/collect" }
+        })
+      ).mockResolvedValueOnce(new Response("ok"));
+      try {
+        await (0, import_vitest.expect)(
+          (0, import_http_request_tool.createHttpRequestTool)().execute(
+            {
+              url: "https://example.com/item",
+              method,
+              body: "private text",
+              timeoutMs: 1e3
+            },
+            {}
+          )
+        ).rejects.toMatchObject({ code: "HTTP_REQUEST_REDIRECT_BLOCKED" });
+        (0, import_vitest.expect)(fetchSpy).toHaveBeenCalledTimes(1);
+      } finally {
+        fetchSpy.mockRestore();
+      }
+    }
+  );
+  import_vitest.it.each([301, 302])(
+    "still turns a cross-origin %i redirect of a POST into a body-less GET",
+    async (status) => {
+      const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch").mockResolvedValueOnce(
+        new Response(null, { status, headers: { location: "https://other.example/" } })
+      ).mockResolvedValueOnce(new Response("ok"));
+      try {
+        await (0, import_http_request_tool.createHttpRequestTool)().execute(
+          {
+            url: "https://example.com/",
+            method: "POST",
+            body: "payload",
+            timeoutMs: 1e3
+          },
+          {}
+        );
+        (0, import_vitest.expect)(fetchSpy.mock.calls[1]?.[1]).toMatchObject({ method: "GET" });
+        (0, import_vitest.expect)(fetchSpy.mock.calls[1]?.[1]).not.toHaveProperty("body");
+      } finally {
+        fetchSpy.mockRestore();
+      }
+    }
+  );
+  import_vitest.it.each([307, 308])("keeps the body on a same-origin %i redirect", async (status) => {
+    const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch").mockResolvedValueOnce(new Response(null, { status, headers: { location: "/moved" } })).mockResolvedValueOnce(new Response("ok"));
+    try {
+      await (0, import_http_request_tool.createHttpRequestTool)().execute(
+        {
+          url: "https://example.com/submit",
+          method: "POST",
+          body: "payload",
+          timeoutMs: 1e3
+        },
+        {}
+      );
+      (0, import_vitest.expect)(fetchSpy.mock.calls[1]?.[0]).toBe("https://example.com/moved");
+      (0, import_vitest.expect)(fetchSpy.mock.calls[1]?.[1]).toMatchObject({ method: "POST", body: "payload" });
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+  (0, import_vitest.it)("still follows a cross-origin 307 when there is no body", async () => {
+    const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch").mockResolvedValueOnce(
+      new Response(null, {
+        status: 307,
+        headers: { location: "https://other.example/" }
+      })
+    ).mockResolvedValueOnce(new Response("ok"));
+    try {
+      const result = await (0, import_http_request_tool.createHttpRequestTool)().execute(
+        { url: "https://example.com/", method: "GET", timeoutMs: 1e3 },
+        {}
+      );
+      (0, import_vitest.expect)(result).toMatchObject({ ok: true, body: "ok" });
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+});
+(0, import_vitest.describe)("http_request cloud metadata hosts", () => {
+  const METADATA_HOSTS = [
+    "metadata.google.internal",
+    "METADATA.GOOG",
+    "instance-data.",
+    "instance-data.ec2.internal",
+    "169.254.169.254",
+    "[fd00:ec2::254]",
+    "100.100.100.200",
+    // Not private ranges, so only the metadata check refuses them.
+    "168.63.129.16",
+    "[::ffff:a83f:8110]"
+  ];
+  import_vitest.it.each(METADATA_HOSTS)("refuses %s before fetching", async (host) => {
+    const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch");
+    try {
+      await (0, import_vitest.expect)(
+        (0, import_http_request_tool.createHttpRequestTool)().execute(
+          { url: `http://${host}/latest/meta-data/`, method: "GET", timeoutMs: 1e3 },
+          {}
+        )
+      ).rejects.toMatchObject({
+        code: "HTTP_REQUEST_UNSAFE_TARGET",
+        message: `Request to ${new URL(`http://${host}`).hostname} is blocked`
+      });
+      (0, import_vitest.expect)(fetchSpy).not.toHaveBeenCalled();
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+  (0, import_vitest.it)("refuses a redirect to a metadata host name", async () => {
+    const fetchSpy = import_vitest.vi.spyOn(globalThis, "fetch").mockResolvedValue(
+      new Response(null, {
+        status: 302,
+        headers: { location: "http://metadata.google.internal/computeMetadata/v1/" }
+      })
+    );
+    try {
+      await (0, import_vitest.expect)(
+        (0, import_http_request_tool.createHttpRequestTool)().execute(
+          { url: "https://example.com/", method: "GET", timeoutMs: 1e3 },
+          {}
+        )
+      ).rejects.toMatchObject({
+        code: "HTTP_REQUEST_UNSAFE_TARGET",
+        message: "Request to metadata.google.internal is blocked"
+      });
+      (0, import_vitest.expect)(fetchSpy).toHaveBeenCalledTimes(1);
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+  import_vitest.it.each([
+    // Not private ranges, so only the metadata check refuses them.
+    "168.63.129.16",
+    "::ffff:168.63.129.16",
+    // Also private ranges.
+    "169.254.169.254",
+    "fd00:ec2::254",
+    "192.0.0.192",
+    "100.100.100.200"
+  ])(
+    "the connection lookup refuses a public name that answers the metadata address %s",
+    async (address) => {
+      const dnsLookup = import_vitest.vi.fn().mockResolvedValue([
+        { address: "93.184.216.34", family: 4 },
+        { address, family: 4 }
+      ]);
+      const safeLookup = (0, import_http_request_tool.createSafeLookup)({ dnsLookup });
+      const error = await new Promise((resolve) => {
+        safeLookup(
+          "files.example.com",
+          { all: true },
+          ((err) => resolve(err))
+        );
+      });
+      (0, import_vitest.expect)(dnsLookup).toHaveBeenCalledOnce();
+      (0, import_vitest.expect)(error).toMatchObject({ code: "HTTP_REQUEST_UNSAFE_TARGET" });
+      (0, import_vitest.expect)(error?.message).toBe("Request to files.example.com is blocked");
+    }
+  );
+  import_vitest.it.each(["metadata.google.internal", "metadata.goog", "instance-data"])(
+    "the connection lookup refuses %s without resolving it",
+    async (host) => {
+      const dnsLookup = import_vitest.vi.fn().mockResolvedValue([{ address: "93.184.216.34", family: 4 }]);
+      const safeLookup = (0, import_http_request_tool.createSafeLookup)({ dnsLookup });
+      const error = await new Promise((resolve) => {
+        safeLookup(
+          host,
+          { all: true },
+          ((err) => resolve(err))
+        );
+      });
+      (0, import_vitest.expect)(error).toMatchObject({ code: "HTTP_REQUEST_UNSAFE_TARGET" });
+      (0, import_vitest.expect)(dnsLookup).not.toHaveBeenCalled();
+    }
+  );
 });